in this post, i rant about licensing

Posted Dec 19, 2008 21:43 UTC (Fri) by bcs (guest, #27943)
Parent article: in this post, i rant about licensing

Tom's blog post raises a number of issues, and we've been working to address them ever since we saw it early this week. For instance, afio was removed from the Free Software Directory on Wednesday, and we are currently reviewing the notes he made about GNUstep Live and Trisquel to make sure they can be addressed properly.

He also points out that afio is included in many of the distributions we endorse, despite the fact that it has some bad license requirements. We certainly agree that this issue needs to be addressed; the gNewSense maintainers are already committed to removing it (if they haven't already), and we're working on getting the word out to others. However, we don't believe that a distribution needs to perform a full audit of its source to be considered fully free. Building any sort of software distribution is an ongoing process of continuous improvement. That's not to say that they should be lackadaisical about it either; it would be unacceptable for a distribution to include everything it could until someone else complained about it. What we like to see is a commitment to making sure that all of the software in the distribution is free, and a sustained, good faith effort to make that happen. As our Guidelines for Free System Distributions say:

There's a lot of code in most free system distributions today; the amount of effort it would take to audit it all directly is impractical for most teams. In the past, some nonfree code has accidentally been included in free system distributions. We don't de-list distributions because of this; instead, we only ask that a distribution put forth a good faith effort to avoid including nonfree software, and commit itself to removing such programs if they are discovered later.

It's difficult to perform a complete audit unless you have the backing of some large, well-funded company—say, a company like Red Hat. It's great that Fedora is doing this work; it benefits the entire free software community. The way they tracked down afio like this is a great example of why, and we expect that any distribution committed to being fully free will respond appropriately.

-- Brett Smith, FSF License Compliance Engineer

in this post, i rant about licensing

Posted Dec 19, 2008 21:54 UTC (Fri) by dowdle (subscriber, #659) [Link] (1 responses)

How do projects like Fossology (http://fossology.org/about_us) fit into this?

in this post, i rant about licensing

Posted Dec 19, 2008 22:46 UTC (Fri) by bcs (guest, #27943) [Link]

FOSSology can be a useful tool for doing the data-searching part of a licensing check. Instead of going through each file by hand and noting its license, FOSSology can basically do that part for you. But a human still needs to go through those results and interpret themwhich is especially tricky in cases like the afio one spot found where there are misleading license notices. So, in its current state, it can save a lot of time, and maybe even suggest problem spots to check out, but I'm not sure it makes the work any less of an effort, if that makes sense.

in this post, i rant about licensing

Posted Dec 19, 2008 23:09 UTC (Fri) by jspaleta (subscriber, #50639) [Link]

So other than Red Hat, what corporate entities in the community are providing the legal expertise necessary to do the task are making that effort?

If this can only be done well if lawyers get involved, are other corporate entities failing to interact in good faith by not putting their in-house legal expertise on the problem?

Perhaps you should have a cheers area of you webpages specifically for corporate entities who are making the good faith effort to help community by providing legal assistance for auditing.

-jef

Proactive future?

Posted Dec 20, 2008 0:53 UTC (Sat) by mmcgrath (guest, #44906) [Link] (6 responses)

Reacting to what Tom has done is great, but had it been found downstream Tom wouldn't have had to do it in the first place.

What is being done to find these things in the future?

Proactive future?

Posted Dec 20, 2008 0:57 UTC (Sat) by JoeBuck (subscriber, #2330) [Link] (5 responses)

Downstream? That usually refers to distros, and Tom's writing on behalf of Fedora, a distro. Did you mean upstream? For old code, often there is no active upstream.

Proactive future?

Posted Dec 20, 2008 1:04 UTC (Sat) by mmcgrath (guest, #44906) [Link] (4 responses)

Sorry, of course. I misspoke.

If it truly is just "unresponsive upstream" problems. Who's responsible for abandoned code? Legally I mean.

Proactive future?

Posted Dec 20, 2008 3:21 UTC (Sat) by spot (guest, #15640) [Link] (3 responses)

Like all licensing questions, the answer here is "depends".

Who's responsible for abandoned code? The copyright holder is. Of course, they aren't required to do anything with it, all the rights you get are what the copyright holder grants you, and nothing more.

Lets say that I, Tom Callaway, write some code with a craptastic license, then disappear. Since I'm a US Citizen, the code that I hold copyright on is available only under terms that I make available (aka, my lame license) for a duration period of "life of the author plus 70 years". Assuming I live to the ripe old age of 95 (and that no further copyright extensions occur during that period, which is rather unlikely given that the US government does it every 20 years or so), then the code would pass into the public domain in 2145.

In the case of afio, it is considered a "work of corporate authorship". In the US, that means the copyright term is "120 years after creation or 95 years after publication, whichever endpoint is earlier." So, again, barring a likely copyright extension, the afio code will pass into the public domain in 2080. Not as bad as 2145, but I really hope our future ape overlords don't need afio in 2080.

That's the only recourse you've got. Convince the copyright holder to change the terms (or permit use under different terms) or wait for it to pass into the public domain. It's worse when the copyright holder is deceased (9wm, for example). We can't get new terms, we just get to wait ~70 years.

Proactive future?

Posted Dec 20, 2008 10:07 UTC (Sat) by pebolle (guest, #35204) [Link] (2 responses)

> It's worse when the copyright holder is deceased (9wm, for example). We
> can't get new terms, we just get to wait ~70 years.

Aren't the heirs (then presumably copyright holders - or at least holders of most rights associated with the works of the deceased) allowed to do the things any holder of copyrighted works is allowed to do (e.g. transfer top a third party or relicense)?

Or are you referring to practical problems: the number of heirs may be large; the heirs could have conflicting opinions on the way the should handle their (collective) rights; the heirs may be difficult to track down, etc.?

Proactive future?

Posted Dec 20, 2008 14:38 UTC (Sat) by spot (guest, #15640) [Link] (1 responses)

So, yes, this is correct, the copyright follows laws of inheritance. It might be possible to get whomever inherited it to give new terms.

Proactive future?

Posted Dec 22, 2008 21:20 UTC (Mon) by lambda (subscriber, #40735) [Link]

This is, of course, assuming that you can figure out who inherited the license, and get them to care
enough to do something about it. Tracking down who should have inherited something can be quite
difficult.

This mess is part of why I feel like some kind of requirement to make even a token effort to renew a
copyright after 10 or 20 years would be good. That would mean that there could be a database of
everything that is under copyright and more than 10 or 20 years old, and it would be a lot easier to
track down whoever owned the work.